Free CPENT sample questions
Real questions from the Certified Penetration Testing Professional practice bank, with the correct answer and an explanation for each one. No junk, no filler.
Try them in the simulator Same questions, with study, timed and flashcard modes.
Showing 10 of 20 free sample questions.
You are preparing the scoping document for a penetration test of a financial institution. The client requires that the test be conducted from the perspective of a malicious insider with standard user access. This type of test is BEST described as:
While conducting OSINT on a target organization, you wish to identify all subdomains associated with 'example.com' that might be hosting development or staging environments. You decide to use a tool that queries multiple search engines (Google, Bing, etc.) and Shodan without actively scanning the target's network. Which tool is MOST suitable for this passive reconnaissance task?
A penetration tester wants to use Google Dorks to find publicly exposed PDF documents on a target website 'target-site.com' that might contain 'confidential' in the text. Which syntax is correct?
You are performing a DNS analysis and suspect that the target's nameserver is misconfigured to allow Zone Transfers. You are using the `dig` command on a Linux system. Which command syntax would you use to attempt a full zone transfer for the domain `example.com` from the nameserver `ns1.example.com`?
A security consultant is using Shodan to identify industrial control systems exposed to the internet. They want to search for devices running the Modbus protocol on the standard port. Which search query should they use?
During a social engineering engagement, you plan to use the Social-Engineer Toolkit (SET) to harvest credentials. You want to clone the target's corporate login page and host it on your attacking machine, then email a link to the employees. Which attack vector in SET should you select?
A penetration tester is drafting a phishing email targeting C-level executives. The email is crafted to look like a subpoena from a federal court, urging immediate action. This specific type of social engineering attack is known as:
You are attempting to scan a target network that is protected by an Intrusion Detection System (IDS). You want to fragment your Nmap scan packets to make it harder for the IDS to recognize the scanning signature. Which Nmap switch should you use?
While conducting an external penetration test, you discover a Windows server with Port 445 open. You want to check for the MS17-010 (EternalBlue) vulnerability using Nmap's scripting engine. Which command is MOST appropriate?
10 more free samples are waiting
Create a free account to unlock the whole CPENT sample bank, or get full access to all 250 practice questions in the simulator.